- Security
- Privacy
- Performance
A Trojan is a nasty, sneaky type of malware that disguises itself as something harmless to fool you into installing it. Learn how Trojans work, how to recognize them, and how to keep Trojans and other malware off your device with a top-rated cybersecurity tool.
.svg)
Trojan horse malware is a file, program, or piece of code that appears to be legitimate and safe, but is actually malware. Trojans are packaged and delivered inside legitimate software (hence their name), and they’re often designed to spy on victims or steal data. Many Trojans also download additional malware after you install them.
The Trojan gets its name from the Trojan Horse in the Greek epic poem The Iliad. In the story, the Greek hero Odysseus hatches a plan to construct a giant wooden horse that his enemies — the Trojans — would receive into their city as a gift. But within the belly of the horse hid a legion of soldiers, who emerged under cover of night to decimate the city of Troy from within.
Trojan malware works the same way — it pretends to be something harmless, but it’s just a cover for its real, malicious intent. To stay protected against trojans and other malware, download free antivirus software for Windows 10 or Windows 11.
Trojans work by masquerading as legitimate files, with the goal of tricking victims into clicking, opening, or installing them. Once this happens, the Trojan begins installing malware on your device, spying on you, or causing other types of harm.
"Trojans are typically spread through social engineering techniques, such as phishing emails or infected file downloads. Once installed, Trojans grant attackers complete access to the victim's device, enabling them to execute various malicious activities."
For example, email Trojans will use social engineering techniques to mimic mundane email attachments. The email itself will also seem trustworthy, but it’s actually a fraudulent email sent by a cybercriminal. When you open the attachment, the Trojan activates and starts attacking your device. The deceit is a central part of the Trojan horse definition.
Trojans are not viruses, but they are a type of malware. People sometimes refer to “Trojan viruses” or “Trojan horse viruses,” but there’s no such thing. That’s due to one critical difference in how viruses and Trojans infect victims. While viruses self-replicate, spreading from one victim to the next, Trojans need you to install them.
That distinction is what distinguishes viruses from Trojan horse malware. Of course, viruses and Trojans themselves are both kinds of malware.
Trojans aren’t viruses, but they are a type of malware.
Trojan horse programs are sneaky, but if you know what to look for, you can recognize the signs of a Trojan attack and begin the process of Trojan removal. Here are the most common signs of a Trojan malware attack:
Your computer feels slow
Trojans often install additional malware that together can consume a large amount of computing resources. Remove the Trojan malware infection to speed up your PC or other device.
Crashes and freezes
Sometimes, Trojans may overwhelm your computer and cause crashes or other failures. The infamous Blue Screen of Death is always a cause for concern.
Unfamiliar apps on your device
Many Trojans install additional malware. If you notice anything unfamiliar in your Windows Task Manager or macOS Activity Monitor, look it up — it might be malware.
Internet redirects
Some Trojans change your DNS settings or manipulate your browser to redirect you to malicious sites that can harvest your data or infect you with additional malware.
Changes to your desktop, taskbar, or browser
As the Trojan installs new malware or makes other changes to your computer, you may see new icons on your desktop or in your taskbar. The same goes for browser toolbars or plugins that you didn’t install yourself — look out for these browser hijackers.
More pop-ups
Are you seeing more pop-ups than usual? A Trojan may have installed adware on your device.
Your antivirus software is deactivated
Trojans and other malware don’t want to be detected and removed — so they’ll try to turn off your antivirus software. Protect yourself against Trojans and other malware with a free antivirus solution that stops them before they can inflict harm.
Avast Free Antivirus automatically detects and blocks Trojans from infecting your devices. And it’ll clear out any infections currently on your machine. Protect yourself from Trojans with an award-winning antivirus tool.
Backdoor TrojansCybercriminals use backdoor Trojans to give themselves a “backdoor” into your device — a way to access your computer without your knowledge. This backdoor is often used to install more malware, spy on you and collect your data, or rope your computer into a botnet.
Banking TrojansBanking Trojans infiltrate your devices and steal your financial login credentials. Hackers use them to crack your banking and other financial accounts. The Zeus Trojan — one of the most infamous Trojans to date — was a banking Trojan.
DDoS TrojansDDoS Trojans aim to conscript your device into a botnet: a network of linked devices controlled remotely by a hacker known as a bot herder. They’ll use the botnet to carry out distributed denial of service (DDoS) attacks that shut down other websites and internet services.
Dropper or downloader TrojansDroppers are the first stage in a blended threat — a three-part malware package that consists of a dropper, loader, and more maware (often a rootkit). The dropper Trojan infects your device and sets the stage for the loader, which in turn installs a rootkit that gives a hacker access to your device. Other downloader Trojans will install other types of malware.
Exploit TrojansThese devious Trojans use exploits — software tricks designed to leverage a known software or hardware vulnerability — to infect your device. Zero-day exploits target vulnerabilities that no one but the exploit creator has discovered yet.
Fake antivirus TrojansA dangerous type of scareware, fake AV Trojans pretend to detect viruses and other malware on your device, then urge you to pay for security software — which is either useless or actively malicious. When you pay, the Trojan creator gets your payment details.
Gaming TrojansGaming Trojans target online gamers and steal their login info. Cybercriminals can use these to crack the accounts of high-profile players or steal valuable in-game items.
Infostealer TrojansData theft is the goal with infostealer Trojans. They’ll comb through your device for sensitive personal data, then send it back to the hacker who attacked you. Cybercriminals can use this data to commit fraud or identity theft.
"Data-stealing threats like Glove Stealer heavily focused on cryptocurrency wallets, 2FA authenticators, password managers, and email clients... bypassing App-Bound Encryption in Google Chrome using new exploitation mechanisms."
Instant message TrojansTargeting the instant message (IM) apps on your device, IM Trojans hijack your login credentials and help themselves to your contact list. Newer IM apps that use encryption like WhatsApp or Signal are less vulnerable than older services such as Skype or MSN Messenger — but malware is always evolving.
Mailfinder TrojansLess of a danger in the era of webmail services like Gmail, mailfinder Trojans target email apps like Microsoft Office and plumb them for email addresses. Cybercriminals can add any plundered email addresses to their spamming or phishing attacks.
Ransomware TrojansRansomware is a type of malware that blocks your access to your data or device, then threatens to either publish, permanently withhold, or destroy the data unless you pay a ransom. Ransomware Trojans use deceit to trick victims into activating the ransomware.
SMS TrojansSMS Trojans infect mobile devices, usually Android, and either send expensive SMS messages to premium services owned by the cybercriminal, or intercept messages coming to and from your phone.
Trojan horse malware has caused some of the most notorious cyberattacks in history. Here’s a look at several of the most well-known Trojans.
The ZeuS Trojan first appeared in 2007 in a data theft attack on the US Department of Transportation. Known mostly as a banking Trojan, ZeuS is commonly used to steal financial information through two browser-based techniques:
Keylogging: the Trojan records your keystrokes as you enter info into your browser.
Form grabbing: ZeuS can intercept your username and password when you log in to a website.
Spread largely via phishing emails and automatic drive-by downloads on infected websites, ZeuS eventually infected millions of computers — which is why it was used to create Gameover ZeuS, one of the most notorious botnets of all time.
First detected in 2014, Emotet began as a banking Trojan. But after cybercriminals began using it to distribute other malware instead, Emotet made serious waves in cybersecurity.
Routinely hailed as one of the most damaging malware strains ever created, Emotet targeted corporate and individual victims alike through massive spam and phishing campaigns. The malware was used to create several botnets, which were then rented out on a malware-as-a-service (MaaS) model to other enterprising cybercriminals.
Emotet was finally disrupted in 2021 via a coordinated global law enforcement effort.
Trojans aren’t just for Windows — Shedun is an Android adware Trojan horse that repackages legitimate Android apps with bogus adware, before rehosting them on third-party download portals. When you install the app from one of these sites, you get the adware along with it.
Once you install the infected app, you’re spammed with ads that generate revenue for the attacker. Removing the malware from your Android device is very difficult, and most victims opted to buy new devices instead. By 2016, Shedun was reported to have infected over 10 million Android devices.
Trojans can affect mobile devices as well as desktop and laptop computers. Both Android and iOS have been affected by Trojan horse malware, though Android Trojans are far more common.
The GriftHorse Trojan is a recent Android SMS Trojan that signs victims up to premium messaging services to generate revenue for the attacker. So far, it’s impacted over 10 million victims worldwide. GriftHorse disguises itself as legitimate apps — the most popular of which has over 500,000 downloads alone.
In 2016, the AceDeceiver iOS Trojan was found to be able to attack non-jailbroken iOS devices. Three separate AceDeceiver apps made it through Apple’s internal review processes and were available for download on the official App Store. Learn how to remove malware from your iPhone so you’re ready if this happens to you.
The best way to remove Trojan malware from any device is with specialized Trojan removal software. Removing Trojans is similar to removing viruses and other malware from your computer.
Download antivirus software from a trusted provider.
Enter Safe Mode.
Restart your PC in Safe Mode to prevent any malware from running or using the internet.
Remove temporary files.
Use the Disk Cleanup tool to remove temporary files. This will speed up the malware scan you’ll do next.
Scan your PC for malware.
Use your antivirus software to scan your PC for Trojans and other malware. Your software should detect the malware and remove it automatically.
Recover damaged files or data.
If you’ve been regularly backing up your computer, restore any damaged files or data from your backup.
Download apps and software from official sources.
Trojans are often hosted on third-party app download sites. Get your software directly from the manufacturer or from official portals like the Apple App Store and Google Play — though these have been compromised by Trojans in the past, they’re much safer than other options.
Don’t open unknown email attachments or click strange links.
Fraudulent emails are a popular vector for spreading Trojans. Don’t click attachments or links in emails that you aren’t expecting to receive. Even if the email looks legit, it may be spoofed by a cybercriminal.
Use an ad blocker or secure browser.
Some Trojans spread through infected web ads. An ad blocker or private browser will prevent these and other ads from loading in your browser, preventing infected sites from giving you a Trojan.
Avast Secure Browser is a highly secure browser that automatically blocks ads and protects you against malicious downloads.
Be skeptical of free software.
Trojan creators often disguise their Trojans as free games and other seemingly useful apps. If you’re about to install something new, research it first and read user reviews.
Don’t click web banners or unfamiliar links.
Not all drive-by downloads are handled via malvertising. Some malware creators develop websites that can automatically install Trojans and other malware onto your device as soon as you visit. Avoiding unknown sites reduces your risk of downloading a Trojan.
Use an antivirus tool.
A strong antivirus tool from a reputable provider will automatically keep Trojans off your device. Choose one that doubles as a malware removal tool that can detect and remove Trojans and other malware from your devices as well.
While there are many types of Trojan horse malware, they’re all designed to fool you into installing them. That’s why Trojans can be so hard to detect — they look like legitimate software.
The best way to protect yourself against Trojans is with reliable security software that can help detect, block, and remove all kinds of malware and viruses automatically. That way, there’s no chance for the Trojan to trick you. Stay Trojan-free today with Avast Free Antivirus, an award-winning cybersecurity solution that's 100% free.
